triggering multiple automated security warnings that are meant to stop the theft or unintentional disclosure of government material from federal networks

They were, or at least detected if not prevented. That’s how they knew it happened.